pf synproxy pf handles the 3WHS on behalf of the destination host protects the destination host does not protect the firewall, pf state still created on SYN